350-501 Practice Test 12 — 15 Questions

Question 1

An engineer is troubleshooting an MPLS network where some routers are not exchanging labels via LDP. Which two steps are most appropriate for diagnosing the issue? (Choose two.)

Accepted Answer

Verify LDP neighbor adjacencies using 'show mpls ldp neighbor'.. Verifying LDP sessions with 'show mpls ldp neighbor' and checking interfaces with 'show mpls ldp interface' are standard first steps. Checking MTU or OSPF neighbors are less direct.

Answer

Check the MTU size on all interfaces.

Answer

Reboot all routers to reset LDP sessions.

Answer

Verify that OSPF neighbor relationships are established.

Question 2

In SRv6, which endpoint behavior is used for decapsulating the outer IPv6 header and performing an IPv4 lookup (e.g., for L3VPN)?

Accepted Answer

End.DT4. End.DT4 is the SRv6 endpoint behavior that decapsulates the outer IPv6 header and then performs a lookup in the IPv4 VPN table. End.DT6 is for IPv6, and End.DT2U is for L2VPN.

Answer

End.DT6

Answer

End.DT2U

Answer

End.DX4

Question 3

A service provider is deploying a BNG for subscriber management. Which protocol is typically used to authenticate subscribers and assign IP addresses in a PPPoE-based broadband network?

Accepted Answer

RADIUS. RADIUS is the standard protocol for authentication, authorization, and accounting (AAA) in BNG environments. DHCP assigns IP addresses, but authentication is via RADIUS. TACACS+ is for device administration; IPoE uses DHCP but not typically for authentication.

Answer

DHCP

Answer

IPoE

Answer

TACACS+

Question 4

In SR-MPLS, when a router receives a packet with an MPLS label corresponding to an Adjacency SID, what operation does it perform?

Accepted Answer

It pops the label and forwards the packet out of the specific interface.. An Adjacency SID represents a specific link; when a router receives a packet with that label, it pops the label and forwards the packet out of the associated interface, because the Adjacency SID is a 'penultimate hop popping' type of SID.

Answer

It performs a recursive lookup in the FIB to determine the next hop.

Answer

It pushes an additional label and forwards.

Answer

It swaps the label with the next-hop label and forwards.

Question 5

Which two actions are performed by an MPLS label edge router (LER) when it receives an unlabeled IP packet destined for a prefix with an LSP? (Choose two.)

Accepted Answer

It forwards the packet based on the MPLS label.. The LER (or ingress LSR) imposes a label stack (push operation) on the packet, then forwards it based on the label. It does not swap labels (that's done by LSRs), nor does it pop the label (egress LER does).

Answer

It performs a recursive lookup in the LFIB.

Answer

It performs a label swap operation.

Answer

It pops the top label and forwards based on the inner header.

Question 6

A service provider wants to protect its core routers from control plane attacks. Which two mechanisms are effective in mitigating such attacks on IOS XR? (Choose two.)

Accepted Answer

Unicast Reverse Path Forwarding (uRPF). CoPP polices control plane traffic. uRPF prevents spoofed source IPs, which are often used in attacks. BGP prefix filtering is for routing updates, not control plane attacks. MPLS TTL propagation is for traceroute. NTP authentication secures time sync.

Answer

MPLS TTL propagation

Answer

BGP prefix filtering

Answer

NTP authentication

Question 7

During a DDoS attack, a service provider uses Cisco Peakflow to detect anomalous traffic and then triggers S/RTBH. What must be configured on the router to black hole attack traffic using a /32 null route?

Accepted Answer

A static route to Null0 for the victim IP and a BGP community to trigger blackholing. S/RTBH relies on BGP to propagate a /32 route with a specific community (commonly no-export) pointing to a null interface (e.g., Null0). The trigger router sets the next-hop to a static route pointing to Null0 and advertises it via BGP.

Answer

QoS policy to rate-limit attack traffic

Answer

An inbound ACL blocking the attack source IPs

Answer

PBR to redirect traffic to a scrubbing center

Question 8

An engineer is hardening the management plane of an IOS XR router. Which combination is the most secure for remote administration?

Accepted Answer

SSH with TACACS+ authentication and authorization. SSH provides encrypted remote access, and TACACS+ offers granular AAA control with encryption of all traffic, making it more secure than RADIUS (which encrypts only password) or local authentication.

Answer

HTTP with local authentication

Answer

Telnet with local authentication

Answer

SSH with RADIUS authentication

Question 9

Which TWO are benefits of using EVPN over traditional VPLS for L2VPN services? (Choose two.)

Accepted Answer

Provides MAC address learning via control plane. EVPN offers better control plane (BGP) and supports multi-homing with all-active load balancing.

Answer

Uses LDP for label distribution

Answer

Requires full mesh of pseudowires

Answer

Simpler configuration than VPLS

Question 10

An engineer is configuring BGP prefix filtering on a provider edge router to prevent BGP hijacking. They want to allow only customer prefixes that are registered in the RIR database. What is the most effective method to automate this filtering?

Accepted Answer

RPKI Origin Validation using RTR. RPKI with Origin Validation uses ROAs to validate origin AS, which can be automated. IRR-based filtering with prefix-lists requires manual updates, while RPKI can be automated via RTR.

Answer

AS_PATH filtering based on customer AS

Answer

Manual prefix-lists based on IRR data

Answer

BGP community tagging with customer AS

Question 11

Which access technology in a service provider network uses a passive optical splitter to distribute signals to multiple customers, with typical downstream speeds up to 2.5 Gbps?

Accepted Answer

GPON. GPON is a point-to-multipoint fiber access technology using passive optical splitters, providing downstream speeds up to 2.5 Gbps and upstream up to 1.25 Gbps.

Answer

Metro Ethernet

Answer

DSL

Answer

Cable (DOCSIS)

Question 12

A service provider is hardening management plane access on IOS XR routers. Which TWO measures should be implemented to secure management access? (Choose two)

Accepted Answer

Implement AAA with TACACS+. Enabling SSH only and using AAA with TACACS+ are key management plane hardening steps. SNMPv3 with encryption is also important but not listed as an option.

Answer

Use SNMPv2c for monitoring

Answer

Enable Telnet for remote access

Answer

Disable password encryption

Question 13

An SP is deploying Deep Packet Inspection (DPI) to classify traffic for QoS and security. Which DPI technique is used to identify applications regardless of port numbers?

Accepted Answer

Signature-based pattern matching. DPI inspects packet payloads using signatures, pattern matching, or behavioral analysis to identify applications, even if they use non-standard ports.

Answer

IP address filtering

Answer

Port-based classification

Answer

NetFlow analysis

Question 14

In IOS XR architecture, what is the role of the Secure Domain Router (SDR)?

Accepted Answer

It provides isolation for routing protocols and forwarding tables.. An SDR provides a logical partitioning of router resources, allowing multiple independent virtual routers within a single physical chassis.

Answer

It handles all packet forwarding in hardware.

Answer

It is used for OSPF only.

Answer

It manages the admin plane for all line cards.

Question 15

In EVPN, what is the function of the Ethernet Segment Identifier (ESI)?

Accepted Answer

It identifies a multi-homed device or network segment.. The ESI identifies a multi-homed device or network, enabling all-active redundancy and fast convergence.

Answer

It is used for load balancing among PEs.

Answer

It uniquely identifies a customer MAC address.

Answer

It identifies a VXLAN tunnel.